Changes from copy-from-recipe are overwritten by dependencies

[dbrumann]

I have a recipe that requires among other things the symfony/security recipe and also contains its own security.yaml that is to be copied over as part of my copy-from-recipe.

My problem is, that my configuration file is replaced by the default from the security-bundle when I require it without installing the dependency first. In other words when I install my recipe together with its dependencies the configuration of the dependencies seems to takes precedence over my own. As a result I would have to make these changes manually.

This is not a big issue for framework configuration as I can create a separate file with my settings, but for security.yaml I don't see a way to fix this with a workaround.

For reference:

• composer.json of my package
• recipe being installed
• Steps to reproduce and console output from composer require

edit in case someone is wondering: I also tried using the `%CONFIG_DIR%' parameter instead of hardcoding the folder name in my manifest.json with the same result.

[Pierstoval]

This is similar to symfony/recipes#262, but about security instead of session.

The problem with Security is that you cannot put firewalls nor access control rules in different files, and Flex does not override existing files. IMO the only solution for this is to provide a 100% custom symfony skeleton that would already contain the security.yaml file, so Flex would not be able to override it with either SecurityBundle or your own package.

[dbrumann]

@Pierstoval yes either that or overwrite the security-bundle in my private recipe repository. In either case not being able to overwrite/modify the existing file kind of breaks my idea of using this as a way to create checkpoints for workshop-projects or at least forces me to still have manual configuration steps.

Since this is essentially a duplicate of symfony/recipes#262 feel free to close this issue.

[Pierstoval]

I'm not sure it's a good idea to allow overwriting files from another recipe, at least for now